An IPS, being a system for preventing network traffic threats, is capable of correctly identifying and preventing threats in a network, for example, worms, Trojans, bots, and other system vulnerabilities. The IPS may be deployed on a device such as a firewall to perform security defense on a client or a server.
Specifically, a signature rule base is saved on an existing IPS device, and the signature rule base stores characteristic information that is extracted by analyzing threat traffic in the network in advance, where the characteristic information is signature rules. When performing IPS defense, the IPS device may compile all the signature rules in the signature rule base into a state machine. When the IPS device performs detection on the network traffic, the IPS device may compare characteristics of the network traffic with each state in the state machine to determine whether the network traffic is the threat traffic, and perform security defense for the defense object.
However, with the characteristic information of the threat traffic continuously increased, the number of the signature rules stored in the signature rule base also keeps increasing, so that the generated state machine is relatively gigantic, thereby lowering detection efficiency when the IPS detection is performed on the network traffic.